PRIVACY POLICY

(Bytelantic, Inc. / Saferlayer)

Last updated: July 9, 2026

This Privacy Policy describes how Bytelantic, Inc., hereinafter “Saferlayer”, processes personal data of users who use:

• Saferlayer Free, which applies watermarks locally in the browser ("Saferlayer Free"),
• the paid Saferlayer Pro, which adds PDF and batch support with the same local browser processing ("Saferlayer Pro"), and
• Saferlayer Enterprise, API-based ("Saferlayer Enterprise").

Saferlayer is committed to lawful, fair, transparent data processing in accordance with Regulation (EU) 2016/679 (GDPR), the Spanish Organic Law 3/2018 (LOPDGDD), and other applicable regulations.

1. Identity of the Data Controller

Bytelantic, Inc.
Corporation incorporated in Delaware, United States
Registered address: 131 Continental Dr, Suite 305, Newark, Delaware 19713, USA
Contact email: hi@bytelantic.com

European Union Representative (Art. 27 GDPR):
Carlos Sánchez García
Apartado de Correos 40143 28007 Madrid Spain

2. Scope of this Policy

This Policy applies to:

• users of Saferlayer Free (no registration required),
• users of Saferlayer Pro (with a paid account),
• companies and users of Saferlayer Enterprise (with an Enterprise account),
• general use of the website and its functionalities.

Processing activities are differentiated for each service type.

3. Data We Process

3.1 Saferlayer Free (no personal data is processed)

In Saferlayer Free:

• images are never transferred to Saferlayer servers,
• no files are received or stored,
• all processing occurs locally within the User's browser,
• Saferlayer has no access to such images or results.
• PDF files are not available in Saferlayer Free.

The only data associated with the use of Saferlayer Free are:

• anonymous or aggregated usage and analytics data,
• IP address and technical metadata processed by providers such as Cloudflare for security,
• strictly necessary or analytical cookies (per User consent).

⚠️ Saferlayer does not collect or store personal data contained in images processed by Saferlayer Free.

3.2 Saferlayer Pro (paid plan with account)

Saferlayer Pro processes all file Content locally, exactly like Saferlayer Free:

Images and PDF files: processed locally within the User's browser, without transfer to Saferlayer servers. Saferlayer does not access or store the User's files.

Account data (required):

• Email address
• Password (hashed, never stored in plain text)
• Internal identifiers (user ID)
• Billing data (via Stripe)

⚠️ Saferlayer does not access or store personal data contained in images or PDF files processed by Saferlayer Pro. No file Content ever reaches Saferlayer's servers.

3.3 Saferlayer Enterprise (enterprise accounts)

Saferlayer Enterprise does involve personal data processing.

A) Account data (required)

• Email address
• Password (hashed, never stored in plain text)
• Internal identifiers (user ID, API Keys)
• Billing data when applicable (via Stripe)

B) Data generated by API usage

Minimal technical logs:

• request timestamp
• file size
• type of operation
• status results

Also:

• usage metrics linked to the API Key
• watermark text (processed but not stored)

C) Content submitted for processing (documents/images)

• Ephemeral processing only
• Processed exclusively in memory
• Executed on cloud infrastructure located in Finland (EEA) operated by Hetzner
• Immediate deletion of the original document after returning the processed file
• The original document is never stored, copied, indexed, transferred, or used for any other purpose
• The processed file is stored for a maximum of 24 hours to ensure its availability via API for the user
• The processed file is never stored for more than 24 hours, nor is it copied, indexed, transferred, or used for any other purpose

4. Purposes and Legal Bases

4.1 Saferlayer Free

4.2 Saferlayer Pro

4.3 Saferlayer Enterprise

5. Data Retention

6. Recipients and Subprocessors

Saferlayer uses carefully selected providers:

All subprocessors operate under contracts ensuring GDPR compliance, SCCs, and adequate security measures.

7. International Data Transfers

As a US-based company, Saferlayer may perform international transfers of data in compliance with:

• Standard Contractual Clauses (SCCs),
• additional technical and organizational safeguards.

Processing carried out on Hetzner infrastructure located in Finland (EEA) does not constitute an international transfer.

Saferlayer Pro and Saferlayer Enterprise account data is stored in the EU (Supabase EU region).

Content submitted to the Saferlayer Enterprise API is processed ephemerally on infrastructure located in the EU (Hetzner – Finland).

8. Security of Processing

Saferlayer implements appropriate technical and organizational measures, including:

• exclusively in-memory processing,
• execution of Enterprise API processing on infrastructure located in Finland (EEA) operated by Hetzner,
• immediate deletion of Content,
• TLS encryption for all communications,
• strict access controls,
• isolated environments,
• minimal logging without personal data.

9. User and Client Rights (GDPR)

Users and Clients may exercise:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction
• Right to object
• Right to data portability
• Right to withdraw consent (where applicable)

Saferlayer will respond within 1 month.

Requests may be sent to:
📩 hi@bytelantic.com

10. Privacy in Saferlayer Free and Saferlayer Pro

10.1 Saferlayer Free

Because Saferlayer does not process or receive images in Saferlayer Free:

• no personal data contained in such images is processed,
• no legal basis is required for such processing,
• no additional privacy measures are required.

Only:

• technical data,
• essential cookies,
• consent-based analytics

may be processed.

10.2 Saferlayer Pro

In Saferlayer Pro:

• Images and PDF files are processed locally within the User's browser. Saferlayer does not access or process personal data contained in them.
• Saferlayer acts as Data Controller only with respect to account and billing data.

11. Privacy in Saferlayer Enterprise

Saferlayer acts as:

• Data Controller: account data, billing data, usage metrics
• Data Processor: documents/images submitted via the API

Processing of such content is governed by the DPA included in the Saferlayer Enterprise Terms.

Note: In Saferlayer Pro, Saferlayer acts solely as Data Controller with respect to account data, in accordance with the Saferlayer Free and Saferlayer Pro Terms and this Privacy Policy. File Content is processed locally in the User's browser and never reaches Saferlayer.

12. Cookies

Details about cookie usage are provided in the Cookie Policy (Document 4).

13. Minors

The Service is not intended for minors.
In Saferlayer Free:

• Saferlayer does not process identifiable personal data,
• no age verification is required,
• the User is responsible for ensuring they meet the minimum age requirement, which is 16 years old (or the minimum age applicable in their jurisdiction).

In Saferlayer Pro:

• registration with an email address is required,
• no automatic age verification is implemented,
• the User guarantees they are at least 16 years old (or the minimum age applicable in their jurisdiction).

14. Changes to this Privacy Policy

Saferlayer may update this Policy at any time.
The “Last Updated” date will indicate the current version.

Saferlayer Enterprise Clients will be notified of material changes affecting data processing.

15. Contact

For privacy-related inquiries or to exercise rights:
📩 hi@bytelantic.com